全家返利管家

This skill's goals (aggregating family accounts, placing orders for relatives, and performing withdrawals) inherently require access to other services and sensitive credentials, but the SKILL.md and metadata omit how that will be done and what protections exist. Before installing or enabling it, ask the publisher for concrete answers: 1) Which external platforms are supported and what exact credentials/tokens are required? 2) How are credentials obtained, stored, and protected (encryption, retention, who can access them)? 3) Is there a backend server? Where is data stored and in which jurisdiction? 4) Will actions that move money (withdrawals) require explicit human confirmation and multi-factor auth? 5) Can the skill use limited-scope OAuth tokens instead of passwords? 6) Is there an audit log and consent records for each family member? 7) Provide a privacy/security whitepaper or source code so reviewers can inspect it. If the publisher cannot answer or provide verifiable code and a least-privilege authentication design, do not give this skill account passwords, payment credentials, or broad permissions — prefer manual workflows or trusted, reviewed integrations instead.